Extracted

• • Target
    28f045d0c087dbb6c945996baac5a375b9c67b4d36d9668bd93f8a48b2be5775
  • Size 45KB
  • SHA256 28f045d0c087dbb6c945996baac5a375b9c67b4d36d9668bd93f8a48b2be5775
  • MD5 f19fe0460bc92f39d17a912970fee498
  • SHA1 8d1c64ab31175fe41e57e4bd5b0bab318e5a34f0
  • SHA512 72bfb3750f3e4bdb7ecb7a2adb36f4dc0fad3095ee042597f4d84a3c259c93b46881869fa4ec7971ef9945ae6189503f71901626b18f8ecab033965bf4ebe08e
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwweeXKNoRRr8/nPI6lzjbVgX3iIecS+046XqtcgzBu:ku40ZTXEb2deQIRrKA6l3byXSIet+044
  • TLSH
    T159232B003BE8C12BF2BF5F7899F26145857AF6733603D94A1CC4529B4713BC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2